Missing Authentication in SerpBear Allows Remote Notifications from Unauthorized Users

CVE-2026-119705

What is CVE-2026-119705?

SerpBear versions prior to 3.1.1 are vulnerable due to a missing authentication mechanism in the /api/notify endpoint. This flaw enables remote unauthorized attackers to send repeated POST requests without any verification, potentially leading to the unintentional triggering of notification emails. By leveraging this vulnerability, attackers can exhaust SMTP rate limits, activate abuse flags on email service providers, and inundate recipients with unwanted messages, disrupting normal operations.

References